Description

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.

Remediation

References

https://github.com/Manak/npm-programmatic/blob/master/index.js#L18

https://snyk.io/vuln/SNYK-JS-NPMPROGRAMMATIC-564115

Related Vulnerabilities

CVE-2022-1233 Vulnerability in maven package org.webjars.npm:urijs

CVE-2018-8038 Vulnerability in maven package org.apache.cxf.fediz:fediz-core

CVE-2022-21213 Vulnerability in maven package org.webjars:mout

CVE-2019-25103 Vulnerability in npm package simple-markdown

CVE-2023-44270 Vulnerability in npm package postcss

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit